CVE-2023-28329

Summary

CVE	CVE-2023-28329
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-03-23 21:15:00 UTC
Updated	2023-11-07 04:10:00 UTC
Description	Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

Risk And Classification

Problem Types: CWE-89

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Moodle	Moodle	All	All	All	All
Application	Moodle	Moodle	3.11.0	-	All	All
Application	Moodle	Moodle	3.9.0	-	All	All
Application	Moodle	Moodle	4.0.0	-	All	All
Application	Moodle	Moodle	4.1.0	-	All	All
Application	Moodle	Moodle	4.1.1	All	All	All

References

Reference	Source	Link	Tags
Moodle.org: MSA-23-0004: Authenticated SQL injection via availability check	MISC	moodle.org
[SECURITY] Fedora 36 Update: moodle-3.11.13-1.fc36 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 36 Update: moodle-3.11.13-1.fc36 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

283827 Fedora Security Update for moodle (FEDORA-2023-d9c13996b2)